‘Every day is game day:’ Sports psychology expert applies his skills to cybersecurity

Baseball can be a game of heart-stopping pressure. One that requires patience, perseverance, stamina and resilience.

One could say the same for cybersecurity – only the stakes are higher. After all, that shiny “trophy” your cyber opponents are after consists of your credentials, your data, your money and your intellectual property.

So it shouldn’t be a surprise that the same psychological stressors that can send an elite ballplayer into a funk can also negatively impact cybersecurity professionals. With that in mind, security-as-a-service platform provider ReliaQuest last week announced an innovative hire, recruiting former Major League Baseball professional Derin McMains as its director of mental conditioning.

A career minor-league second baseman who was drafted by the San Francisco Giants in the 11^th round out of the University of Arkansas at Little Rock, McMains retired in 2007 with a lifetime average of .257 and joined the organization’s coaching staff. He would later return to school in 2012, earning a master’s degree in psychology and certificate in sports psychology.

He’d go on to serve as peak performance coordinator for the Giants and Seattle Mariners, the director of mental conditioning for the University of Notre Dame athletic program, and later the director of mental skills for the Giants. In these roles, he has helped athletes better cope with the day-in, day-out rigors of playing under pressure, while teaching other coaches sports psychology principles so that could successfully communicate team goals and deescalate stressful situations rather than exacerbate them.

But it was a meeting with Brian Murphy, CEO of Tampa, Florida-based ReliaQuest, that changed the trajectory of his career when McMains realized that the unique skills and knowledge he brought into the sporting world could also apply to business.

“We're all performers,” said McMains. “We all want to be our best every day. Nobody wakes up wanting to stink. But life is hard, and there are challenges, there are obstacles… and so we have built these strategies along the way that allow us to cope better and allow us to see situations a little differently, so we can respond better.”

Now McMains brings his experience full-time to ReliaQuest, including its security operations center operations, while remaining a mental performance consultant for the Arizona Diamondbacks through the self-owned business he started up in 2020, McMains Coaching Mindset, LCC.

Murphy said his reason for hiring McMains is no different from why sporting organizations and special military units use mindset and performance coaches: to elevate performance.

“If it's good for those types of organizations, then why not apply those same strategies to a high-performance tech company?” said Murphy. “In cybersecurity, we’re operating in a high-pressure, high-stakes environment as we work to solve one of the largest technical challenges of our generation. We need to utilize every tool at our disposal to improve ourselves, and that is why we made the investment.”

McMains will be sharing his wisdom in groups sessions and one-on-ones, but also via blog posts and an internal communications platform that will host various podcasts, videos, Instagram story-style shorts. The content will focus on ReliaQuest’s core values and psychological that support them, such as cognitive flexibility and mental contrasting.

He’ll work especially close with the executive team and their direct reports to help teach them to be mental skill coaches as well. “Because we're all coaching mindset whether we know it or not,” McMains said. “We're all impacting the perspective and the thoughts of the people that we lead. And so it's helping them be more intentional in their messaging, their body language, [so] they create more clarity. Because clarity is gonna breed focus, focus will breed confidence, confidence breeds commitment, commitment breeds execution.

SC Media interviewed McMains to learn more about the parallels between sports and businesses, and how he’ll be coaching cybersecurity workers to successfully deal with pressure, overcome burnout, and bounce back from failure.

What got you interested in pursuing mental conditioning?

When I started coaching and managing in the minor leagues, that’s when I really started to see how mindset impacts performance – how our thinking impacts what we do. I really just wanted to become a better coach initially, and so I went back and… got my master’s in psychology first. 

And then realized there was a whole field of sport and performance psychology… It was way more specific in regards to [reaching] optimal performance. Like: who are the people that are really killing it? Why do they stand apart? How do they cope differently? How do they see the world differently? What's their perspective? That really spoke to me.

How does your sports psychology and mental conditioning expertise translate from baseball to cybersecurity?

I see it like standing in the batter's box: You have a plan. You know what the situation requires you to do, you know the score, you know what your opponent is trying to do to you. But you don't actually know what pitch is going to come.

Trust your eyes, trust your training and respond accordingly.

[In cyber], you sit down at your desk, and you don't know what threats are gonna come up. You have no idea what that's going look like. You have an idea, you have a plan, you've maybe seen this before... So there's a lot of parallels there – and then it's just about like trusting your training, being able to communicate effectively, being a great “reflector.”

Explain what being a reflector means.

Experience is not the best teacher. Reflecting on experience, that's the best teacher. It’s not just showing up for your shift, and then walking away from it thinking you got better. No. Think about what went well today, think about things you need to improve. Just like in sports: Just because you got four hits today doesn't mean you did everything right. Because there's a lot of things outside of your control that maybe led to that like a broken-bat base hit, and you just got lucky. Or if you were oh-for-four, it doesn't mean you were terrible. You might have hit every ball on the screws. 

So it’s about being a really good reflector, and then embracing the inevitable adversities that are going to show up, and, and looking forward to them.

I know you can't be in professional sports if you don't love challenges, and I've seen that same thing in cybersecurity – because every day is a challenge. Every day is game day. Bad actors don't take days off. You better bring your best every day. And so it’s helping them build those strategies so they can be their best each and every day.

When security pros are responding to a major incident, the game is on the line. How do you coach athletes or infosec experts to handle pressurized situations?

We first need to understand how our perspective – how we see the world – determines how we think about it… How I think about it determines how I feel about it, and how I feel about it ultimately impacts what I end up doing. And so a lot of mental skills come from making sure we have a proper perspective.

We never want [bad] things to happen, but we know they're going to happen and so let's just look forward to those challenges that we get to tackle. Pressure is a privilege. And then embrace it – it's cool to feel that way because we know that we're doing something special and something that matters to us. If you don't feel pressure in what you do, one, it’s too easy for you, or two, it doesn't really matter to you. Who wants to do that? I'll say things like, “Who wants to play tug-o-war with a toddler?” Nobody wants to do that. It's no fun. We think we do. But it’s not very satisfying.

And then other ways that you can manage pressure are routines. In sport, we talk about pregame routines, and that's just preparing the mind and the body to know that it's about to do something that's important… For example, sometimes people feel butterflies in their stomach in sports, and it helps to understand that what is happening is that your body's shutting down the digestive tract. And that's the acid bubbling around in there. That's what you're feeling. But we've made up this [negative] perspective that “Oh it’s butterflies. You must be nervous.” No, it’s because you're not going to be digesting any food right now because you're about to go compete and throw 100 pitches.

The same is true for our folks at ReliaQuest: What does is your pregame routine like? How do you get into the proper space from a mental perspective when you come into work every day? And so I have them outline their values, and remind themselves of our four core values which are: accountability, adaptability, focus and helpfulness – and then what are the things that are going to allow them to do that every day?

Because if we don't intentionally set our focus on the things that matter, when things show up outside of our control, we'll just become very reactive and we tend to operate outside of the things that are really important to us. Like a pitcher might get away from his game plan in baseball because he wasn't committed to the scouting report and then when he gives up a few broken-bat base hits, he throws the whole thing to the wind. 

And then the last thing I would say about pressure is, [it can] feel overwhelming if we are focused on the things we cannot control. Try to help people focus on the “what is,” not the “what ifs.” It’s important to always have an idea that this could happen, [but] what is right now? How can I take care of the thing that is right in front of me and control what I can control? Because when we have control, then we get a sense of confidence and… we tend to perform better, plain and simple. So it’s not letting the things that you can't control keep you from impacting the things that you can't control.

What are your tips for communicating with overextended employees who are suffering from burnout?

Everybody's a little different but just from a blanket perspective:

On opening day of baseball season it can be really overwhelming… thinking about the 162 games you’ve got to play in 180 days. The good thing is, though, you really only have to play one day at a time.

If you start thinking about all the threats that are coming, if you start thinking about the end of the week on Monday, you're in trouble because you’re not gonna be able to sustain that. And so it's about, one, a change in focus. Instead of all the threats you have to deal with, let's just deal with this one first.

Then, two, I would just start talking to them about recovery techniques…. What's your nutrition look like? What's your sleep look like? And that goes back to, we're all performers. And I know, coming from the world of sports, we spend a lot of money on sleep experts, we spend a lot of money on dietitians and nutritionists, we spend a lot of money on strength coaches and the importance of physical fitness. But those same benefits are for all of us. Because we're all human. And so, let's really talk about how we can help create a better performance lifestyle that supports the high-stress job you have. Because the reality is, we're not going to eliminate the stress.

A universal truth in cybersecurity is that sooner or later you’re going to be breached. Similarly, a universal truth of baseball is that it is a game of failure. If you fail two out of three times, you're a great hitter. How do you teach security professionals to deal with failure, and more importantly to be resilient enough to bounce back?

In sports, you get in that slump, when you really internalize the mistake or internalize the fact that you failed.

And so, one, it’s helping them understand that you can fail and not be a failure.

And then it's shifting focus. If you think too long about the failure… and if all you're doing is focusing on the past, then how can you be present?

So then it's shifting their mindset. Okay, this is what happened. What can we learn from it? Get them to be solution-focused. In sport the equivalent would be, “Hey, he broke your bat, blew up your thumbs. And you're like, “What did he do?” “Well, he threw a hard cutter in on my thumbs.” Okay, what do you think he’ll do next time? Probably throw a hard cutter. There you go. Now you have a solution. Now you have a plan going forward.

And then the second piece for perspective is… accept it. You have to accept that this is a part of the job. It doesn't mean you have to like it. Adversity is inevitable. Misery is optional.

Are there any sports psychology pointers you wish you had been exposed to as a player?

I can't tell you how many times I've said, “Where was I at when I was playing?”

I had five surgeries as a player – and that's what ultimately led to my retirement. I had three shoulder surgeries and two wrist surgeries. I was a switch hitter. And so I had to quit switch hitting my last year and just hit right-handed. And that sucked because I wasn't very good, and that's when I realized, “Oh okay, I'm probably not going to play in the major leagues.”

That's when I decided to no longer play, but the thing that would have really helped me – and I wish I would have talked to somebody about it – was when I was coming back from injury. I was really trying to be the player that I was. I was trying to chase this ghost of a person, of this player that I used to be, instead of embracing and accepting the fact that I'm a different player now.

I really should have just accepted the fact that this is the reality. Control what I can control… That would have been really helpful.

You were coaching in the Giants organization when they won the three World Series in 2010, 2012 and 2014. What was that like?

I learned more than I contributed. I promise you that. It really helps to have an awesome Major League coaching staff and great players. But it was amazing.

Most people [talk about] the three in five years thing, but we were building this machine in the minor leagues of… top talent, and it was cool to coach some of those guys.

But the thing that I was most proud of was how everyone was just so locked in on: “How can we win?” And everyone removed their ego… It was just, hey, how can we help make this guy better? How can we build trust with this guy to make this guy better?

As you’ve learned more about cybersecurity, have you picked up any good tips? Are you starting to realize, “Oh no. My password is terrible!” or anything like that?

[Laughs.] My first month, I learned probably too much, where I felt like I don't ever want to turn on my phone, turn on my computer. And then once I got past the initial shock of, “Oh, this is what's going on,” then it made me happy to be at ReliaQuest because I was like, “Oh, I'm glad we got people that can do this stuff.”